Password manager Dashlane says hackers stole some customers’ password vaults

In a recent security breach, password management provider Dashlane revealed that hackers have managed to access at least a dozen encrypted vaults containing customer passwords. The attack occurred during a weekend, where cybercriminals successfully bypassed the company's two-factor authentication (2FA) system, gaining entry to approximately 20 customer accounts. The hackers utilized a brute-force approach against Dashlane's 2FA protections, which typically require a one-time passcode sent to the user's phone in addition to their username and password. By defeating this security measure, they were able to download copies of certain customers' encrypted vaults, which hold sensitive information like passwords. On its incident page, Dashlane stated that there was no evidence suggesting a compromise of its core systems. However, the company has not disclosed how the hackers circumvented the 2FA protections. "The aim of the attack was to exploit the two-factor authentication system to allow registration of new devices on existing user accounts," Dashlane explained. The company elaborated that attackers may employ automated tools to rapidly generate and submit all possible numeric combinations, attempting to guess the correct sequence before the short-lived security codes expire. In response to the incident, Dashlane has indicated that it has implemented measures to reduce the possibility of similar attacks in the future, though specific details remain undisclosed. Dashlane has reached out to the affected customers, informing them that their encrypted vaults were compromised. It remains uncertain whether these individuals were targeted specifically, based on their identities or occupations. Furthermore, Dashlane has not provided insight into whether the attackers had communicated with the company regarding demands, such as ransom. While the stolen vaults are encrypted and can only be decrypted with the customer's master password, which is not stored in plaintext by Dashlane, the company cautioned that customers with weak or easily guessable master passwords could be at an increased risk. Data breaches involving password management services are uncommon but can have severe ramifications. Previously, in 2022, LastPass disclosed that backups of customer password vaults were stolen during a cyber incident. Although those vaults were also protected by customer-only passwords, earlier password requirements were less stringent, making it easier for hackers to guess them. In 2021, Click Studios warned users of its Passwordstate software to reset all credentials after a similar compromise of its update mechanism led to malware being deployed on customer systems. As the cybersecurity landscape continues to evolve, incidents like these serve as a stark reminder of the importance of robust security practices.